CAPEC-668
Key Negotiation of Bluetooth Attack (KNOB)
An adversary can exploit a flaw in Bluetooth key negotiation allowing them to decrypt information sent between two devices communicating via Bluetooth. The adversary uses an Adversary in the Middle setup to modify packets sent between the two devices during the authentication process, specifically the entropy bits. Knowledge of the number of entropy bits will allow the attacker to easily decrypt information passing over the line of communication.
On this page
Ask an AI about this attack pattern
Show the prompt
Explain the attack pattern CAPEC-668: Key Negotiation of Bluetooth Attack (KNOB): how it unfolds, what it needs and how to prevent and detect it in my systems. Use https://capec.mitre.org/data/definitions/668.html and https://cve.bz/cve/capec/668?via=ask-ai-copy, which lists recent CVEs with the weaknesses it exploits. Cite the sources.Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this attack pattern's id and public links.
How the attack unfolds
Explore
The attacker looks for a way in.
[Discovery] Using an established Person in the Middle setup, search for Bluetooth devices beginning the authentication process.
1 technique
- Use packet capture tools.
Experiment
They probe what they found.
[Change the entropy bits] Upon recieving the initial key negotiation packet from the master, the adversary modifies the entropy bits requested to 1 to allow for easy decryption before it is forwarded.
Exploit
They carry out the attack.
[Capture and decrypt data] Once the entropy of encryption is known, the adversary can capture data and then decrypt on their device.
Prerequisites
Person in the Middle network setup.
Skills required
- Medium skill
Ability to modify packets.
Resources required
Bluetooth adapter, packet capturing capabilities.
Consequences
| Impact | Affects | Note |
|---|---|---|
| Read Data | Confidentiality | |
| Bypass Protection Mechanism | Confidentiality, Access Control, Authorization | |
| Modify Data | Integrity |
Mitigations
Newer Bluetooth firmwares ensure that the KNOB is not negotaited in plaintext. Update your device.
Weaknesses it exploits
Recent CVEs with these weaknesses
- 2.1CVE-2026-124621
A vulnerability was determined in kongxin-github Java_Library_Management_System up to 70a6eb6b96fe64575d8051f1a59055bfc5dc5885. This affects the function UpdateAdmin.deleteuser/UpdateAdmin.updateadmin/UpdateAdmin.updatepass/Book.addbook/Bo…
- 5.5CVE-2026-124590
A security vulnerability has been detected in zhangbw409 library_manager_system f6c9d9c96bf5d2a32ef741daeaa29d80e6db166b/56514767a5207caf5e04c2cea379dfaa8cb5f00b. This impacts the function BookController.addBook of the file src/main/java/c…
- –CVE-2026-123779
Direct Request ('Forced Browsing') vulnerability in Apache Axis2/Java. The exposeServiceMetadata service parameter was enforced only on the ?wsdl, ?wsdl2 and ?xsd queries. For a service that had disabled it, the packaged .wsdl and .xsd fil…
- 5.3CVE-2026-113702
A security flaw has been discovered in iomad up to 4.5.15/5.0.11/5.1.8/5.2.4. Affected by this vulnerability is the function local_iomad_pluginfile in the library public/local/iomad/lib.php of the component PDF Certificate Handler. The man…
- –CVE-2026-40913
Apache Airflow's public Import Errors API returns the raw parse-failure stack trace to any user with the `ImportError.can_read` permission when the failing file has no registered DAG. This happens when a file fails to parse before any DAG …
- 2.1CVE-2026-124574
A vulnerability was determined in chenyme grok2api up to 3.1.6. This vulnerability affects the function beginSelectionSession of the file backend/internal/application/gateway/video.go of the component Video Job Retry Handler. This manipula…
- 4.3CVE-2026-19307
IBM Sterling B2B Integrator 6.2.1.0 through 6.2.1.2_1 and 6.2.2.0 through 6.2.2.1_1, and IBM Sterling File Gateway 6.2.1.0 through 6.2.1.2_1 and 6.2.2.0 through 6.2.2.1_1 Standard Edition could allow a remote authenticated attacker to acce…
- 8.1CVE-2026-19133
IBM Storage TS4500 Library 1.1.1.6 through 1.12.0.3 could allow a remote authenticated attacker to perform unauthorized account takeover due to improper authorization.
The newest records naming one of them. Each weakness's page lists them all.
Related attack patterns
Examples
Given users Alice, Bob and Charlie (Charlie being the attacker), Alice and Bob begin to agree on an encryptio…
Given users Alice, Bob and Charlie (Charlie being the attacker), Alice and Bob begin to agree on an encryption key when connecting. While Alice sends a message to Bob that an encryption key with 16 bytes of entropy should be used, Charlie changes this to 1 and forwards the request to Bob and continues forwarding these packets until authentication is successful.
MITRE's words, unchanged: CAPEC-668 at MITRE. CAPEC is Copyright © 2007–2026, The MITRE Corporation, used under the CAPEC terms of use: “The MITRE Corporation (MITRE) hereby grants you a non-exclusive, royalty-free license to use Common Attack Pattern Enumeration and Classification (CAPEC™) for research, development, and commercial purposes. Any copy you make for such purposes is authorized provided that you reproduce MITRE’s copyright designation and this license in any such copy.” CAPEC and the CAPEC logo are trademarks of The MITRE Corporation. Credits. All attack patterns.